Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 06:26
Behavioral task
behavioral1
Sample
dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll
Resource
win10v2004-20220812-en
3 signatures
150 seconds
General
-
Target
dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll
-
Size
103KB
-
MD5
81694b2bb15b5af53bca37e790fe756f
-
SHA1
3f581d795994707295ed2dc9270ff2c28d61acb7
-
SHA256
dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87
-
SHA512
1020f4126fa268f2a28b7c8c6e50595c5fa924cd35edefad60b384a359a9c3522598ffb3f7b7366d866827fdaae768306f7bfdb5d5c6de87e93f13b1306fc223
-
SSDEEP
3072:xyZLYm4WuyTckIW9sxsNTNE1+eRZm/KyZP:ILYsuyTc/W9sQE1Je/Jt
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2108-133-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 732 2108 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4972 wrote to memory of 2108 4972 rundll32.exe 84 PID 4972 wrote to memory of 2108 4972 rundll32.exe 84 PID 4972 wrote to memory of 2108 4972 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc176b14e83ff21191a79bcf506dea55180300022930c8069fb00b7ef5154f87.dll,#12⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 5883⤵
- Program crash
PID:732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2108 -ip 21081⤵PID:1284